One Apex, Nineteen Subdomains: A Facebook Fake-News Ad Farm

Since October 2024, one operator has run a Facebook fake-news ad farm that funnels clickbait through subdomains borrowing real news brands. The network we tracked uses a single stable domain, besttopixs[.]com, for fabricated sports and celebrity "breaking news" published through nineteen operator-controlled subdomains, some named after real outlets. More than a hundred disposable Facebook advertiser profiles carry the ads across thousands of observed placements. Most use team-fan personas designed to match Facebook's interest targeting. The pages they promote do not steal passwords or card numbers. They monetize attention through ad-stuffed articles that turn outraged clicks into programmatic impressions and affiliate revenue.

Key Takeaways

• The operator rotates subdomains rather than domains. One stable apex fronts nineteen subdomains: fourteen content frontends plus five tracking backends. This is unusual for clickbait farms, which more often burn an entire domain and register a new one.
• News-brand subdomain squatting uses nbcnews[.], abcnews[.], and gnews[.] as leaf labels on the operator's own apex. A reader scanning a hostname from left to right may stop at the familiar brand and overlook the controlling domain on the right.
• The operation monetizes through display-ad arbitrage, not credential or payment theft. The landing pages contain no login form or checkout, only ad inventory and outbound links.
• The advertiser layer operates as a persona factory: more than a hundred fan accounts for the Lions, Manchester City, Real Madrid, Liverpool, Chiefs, and Patriots, alongside re-skinned dormant profiles whose names do not match the sports content they now publish.
• Two registration cohorts support the network: purpose-built 2024 apexes and aged 2021 domains repurposed to inherit residual trust.
• Across late 2025, the operator progressed from generic content labels to explicit news-brand squats, then began moving to a successor apex that squats fourteen multinational outlets.

Background

This network is a made-for-advertising operation. Made-for-advertising sites, or MFA sites, buy cheap traffic and direct it to pages saturated with programmatic display slots. They pocket the difference between the cost of the traffic and the revenue from the ads. Monetization occurs on the advertising side rather than the victim side, which is why these pages resemble thin content farms instead of overtly malicious sites. The Association of National Advertisers has sized MFA inventory at roughly 15 percent of programmatic spend and about ten billion dollars a year. This makes it a mature, well-funded part of the ad economy rather than a fringe tactic.

Fabricated "breaking news" headlines supply the traffic. A shock trade, a star's abrupt exit, or a scandalous quote attributed to a coach creates enough emotional arousal to drive click-throughs and keep visitors paging deeper, multiplying the number of ad loads per visit. Generative text has sharply reduced the cost of producing plausible fake articles at volume. The accounts and creatives distributing them are disposable, so taking down a single ad or profile barely slows the operation.

Two supporting techniques matter to defenders. The first is aged-domain repurposing. Operators buy expired or drop-caught domains registered years earlier because systems score the name's age and clean history rather than its new owner. This is a well-documented "residual trust" problem. Drop-catch marketplaces make decade-old names cheap to acquire, and a mismatch between a domain's legacy identity and current behavior is the tell. The second technique uses real news brands as costumes. Placing nbcnews[.] beneath an unrelated apex borrows the outlet's name without any relationship to it and exploits the same left-to-right reading habit used by spoofed senders and combosquatting. Authentic properties place the brand in the registrable-domain position: nbcnews[.]com, abcnews.go[.]com, news.google[.]com. None would appear as a leaf label beneath a stranger's domain.

Discovery and Infrastructure

We found the network during a broader survey of sports-themed Facebook scam activity. It stood out as the highest-volume infrastructure directing clickbait away from the platform. We mapped it by working backward from the click-through destinations rather than the ad text because the visible creative conceals the operator's actual infrastructure. Each ad resolves to a <subhost>[.]besttopixs[.]com/posts/<slug> article page. Clustering thousands of observed destinations revealed the complete subdomain inventory and the advertiser fleet supporting it.

besttopixs[.]com is the operator's own apex. It was registered through Cosmotown in 2024, has no organization listed in its WHOIS record, and carries a malicious verdict in reputation data. The apex serves no content. Everything resides on subdomains, which fall into three distinct roles.

Indicator	Role	Notes
besttopixs[.]com	Operator apex	Stable hub; no content on the apex itself
flysport[.]besttopixs[.]com	Content frontend	Highest-volume sports-clickbait label
topdaily[.]besttopixs[.]com	Content frontend	High-volume generic news label
nbcnews[.]besttopixs[.]com	Brand-squat frontend	Leaf label impersonating NBC News
abcnews[.]besttopixs[.]com	Brand-squat frontend	Leaf label impersonating ABC News
gnews[.]besttopixs[.]com	Brand-squat frontend	Leaf label impersonating Google News
smart1[.]besttopixs[.]com	Tracking backend	No content telemetry; redirect/ad-tracking role

The advertiser layer consists of a rotating pool of disposable Facebook profiles. Most adopt a sports-fan persona tailored to a particular team because fan audiences are inexpensive to target and closely match the creative. A single ad usually maps to a single persona. The operator allows Facebook's takedowns to thin the pool while replacing the removed profiles with new ones.

How It Works

A fan scrolling through Facebook sees a sponsored post that appears to come from a team-fan page. Its creative uses a fabricated headline designed to provoke outrage or curiosity. The visible post rarely displays a link. Instead, the click-through destination is embedded in the ad's resolved URL and leads to a fake article hosted on one of the operator's subdomains.

Advertiser: "Lions Den Detroit" (disposable Facebook profile)
Ad hook:    Detroit's $3.2 Billion Gamble: Lions Unleash a Revolution
Click-through resolves to:
            http[:]//topdaily[.]besttopixs[.]com/posts/detroits-3-2-billion-gamble-lions...

The landing page is a content-farm article presented as a news story. It has no login prompt or checkout. Instead, it contains programmatic ad inventory and outbound links, often distributed across multiple pages so that one reader generates several ad loads. The fabricated quote or transfer figure in the headline never leads to anything real. The story only needs to hold the reader's attention long enough to earn the click and scroll.

Sample Lures

Every sample below comes from a Facebook sponsored ad. We reconstructed each lure headline from its fabricated-article destination. The named athletes and clubs are public figures used as bait. This network contains no recipient or victim data because its landing pages are public clickbait rather than personalized messages. All destinations are defanged.

Channel:   Facebook sponsored ad
Persona:   "Lions Den Detroit" (NFL Detroit Lions fan page)
Headline:  Detroit's $3.2 Billion Gamble: Lions Unleash a Revolution
Destination: http[:]//topdaily[.]besttopixs[.]com/posts/detroits-3-2-billion-gamble-lions...
Pretext:   Fabricated blockbuster-money "breaking news" for a team-fan audience

Channel:   Facebook sponsored ad
Persona:   "Manchester City Global Fans" (EPL fan page)
Headline:  Pep Guardiola Issues Ultimatum After Shock Dressing-Room Report
Destination: http[:]//plant[.]besttopixs[.]com/posts/pep-guardiola-issues-u...
Pretext:   Fabricated manager-drama quote engineered for outrage clicks

Channel:   Facebook sponsored ad
Persona:   "Foxborough GameDay Syndicate" (NFL Patriots fan page)
Headline:  This Is a Crime Against Football
Destination: http[:]//nbcnews[.]besttopixs[.]com/posts/...
Pretext:   Outrage-bait headline delivered through an NBC News brand-squat subdomain

Technical Analysis

Apex-and-Subdomain Architecture

The entire network depends on one registrable domain. besttopixs[.]com fronts nineteen subhosts, and the operator's design becomes visible at the subhost level rather than the apex. Fourteen serve as content frontends, while five are tracking backends with no content telemetry.

Role	Count	Labels
Brand-squat content frontend	3	nbcnews[.], abcnews[.], gnews[.]
Generic content-label frontend	11	flysport[.], topdaily[.], plant[.], sporting[.], dailynews[.], celebrity[.], viral[.], amazing[.], sport[.], sportnewss[.], nyheter[.] (Swedish for "news")
Operator backend / tracking	5	smart1[.], smart2[.], smart3[.], smart5[.], ort[.]

Subdomain rotation gives the operator immediate access to inexpensive new hostnames while preserving the reputation and age of one apex. This reverses the burn-a-domain-a-day pattern common among shorter-lived clickbait operations and makes the apex the durable pivot: one malicious verdict on besttopixs[.]com applies to every label beneath it.

The Subdomain-Squat Grammar

Three content frontends borrow the names of real outlets. nbcnews[.], abcnews[.], and gnews[.] are leaf labels on the operator's apex, producing hostnames such as nbcnews[.]besttopixs[.]com. A user reading from left to right encounters the trusted brand first and may stop there. The brand token is cosmetic text fully controlled by the operator and establishes no connection to the real outlet. The genuine properties place the brand in the registrable-domain position (nbcnews[.]com, abcnews.go[.]com, news.google[.]com). The other eleven frontends make no such pretense and instead use generic sports, news, and viral labels. They include a Swedish-language nyheter[.] frontend that indicates non-English targeting.

Registration Cohorts and Aged-Domain Staging

The operator's domains divide into two cohorts, and that division is a strong fingerprint.

Apex	Registrar	Reg. year	Cohort	Malicious in reputation data
besttopixs[.]com	Cosmotown	2024	Purpose-built hub	Yes
topnewsource[.]com	Namecheap (privacy)	2024	Purpose-built successor	Yes
fiatagri[.]co	Namecheap	2021	Aged, repurposed	Yes
medianews48[.]com	Namecheap	2021	Aged, repurposed	Yes

The 2024 apexes are purpose-built hubs. The two 2021 domains are older names that were purchased and repurposed. They demonstrate the residual-trust approach in miniature: fiatagri[.]co retains a legacy name unrelated to the sports clickbait it now hosts, precisely the legacy-identity mismatch associated with a repurposed domain. All four now carry malicious verdicts.

Subhost Lifecycle and the Escalation to Brand Squats

Reputation first-seen data provides a clear timeline. An early cohort of five frontends appeared in October and November 2024 (amazing[.], sport[.], viral[.], celebrity[.], sportnewss[.]) and has since become inactive. The current content frontends appeared throughout late 2025. flysport[.] arrived in September, followed by plant[.] and dailynews[.] in early October, then sporting[.], nyheter[.], and topdaily[.]. The three news-brand squats are the latest additions: gnews[.] in October 2025, abcnews[.] in November, and nbcnews[.] at the end of December. The operator provisioned the tracking backends separately, with the smart* labels appearing across 2025 and ort[.] in early 2026.

The sequence shows an escalation. The operator began with generic clickbait labels and introduced explicit news-brand impersonation only after the model was working, adding the higher-risk squats to infrastructure that already carried traffic.

The Advertiser-Persona Factory

More than seventy distinct advertiser profiles distribute the ads, and their construction is deliberate. Team-fan personas correspond to specific content frontends: Detroit Lions and Steelers pages direct traffic to topdaily[.]; Manchester City, Real Madrid, and Liverpool pages direct it to plant[.]; Liverpool and Arsenal pages direct it to flysport[.]; and Chiefs and Patriots pages direct it to the brand-squat frontends gnews[.], nbcnews[.], and abcnews[.]. Fan targeting keeps each ad inexpensive and relevant to the audience most likely to click a shock headline about its club.

The fleet also contains re-skinned dormant profiles with names unrelated to sports. A home-decor page ("Beautiful House"), a science page ("ABC Archaeology"), a wildlife page, and an oddities page all publish sports clickbait. The operator places new creative on aged accounts to inherit their history and avoid new-account heuristics, applying the same residual-trust technique at the account layer. Multilingual personas extend the operation's reach, including a Spanish-language Chicago Cubs page that directs traffic to dailynews[.]. The persona name is therefore not a reliable filter. The click-through infrastructure is.

Migration to a Successor Apex

The two highest-volume personas, the Detroit "Lions Den Detroit" and "Honolulu Blue" pages, have started directing traffic to a successor apex, topnewsource[.]com. It uses the same /posts/<kebab-headline> grammar, fan-persona model, and news-brand-squat technique. The successor is a larger deployment: a WordPress multisite that squats fourteen multinational outlets as subdomains and expands beyond a few US brands to German, French, Indonesian, and Filipino news names. The rotation apexes fiatagri[.]co and medianews48[.]com serve a parallel function, hosting the same content at apex-level /kebab paths instead of subdomains.

Detection Observations

The behavioral signals distinguishing this traffic from legitimate sports media appear in the click-through rather than the visible ad.

• The click destination provides the tell, not the creative. Because the visible sponsored post often contains no link, a pipeline limited to ad copy cannot see the operation. The resolved click-through reveals the <label>[.]<apex>/posts/<kebab-headline> grammar.
• A real news-brand token in the subdomain leaf position beneath an unrelated apex is a portable, operator-independent signal. Legitimate outlets never appear as leaf labels beneath a stranger's domain.
• The lander's structure distinguishes arbitrage from theft. A page containing heavy ad inventory and outbound links, but no login form or checkout, is a content-farm monetization surface rather than a credential-harvest page. It should be triaged as ad fraud and deception, not phishing.
• Persona names add noise. Dormant, unrelated profiles can be re-skinned with sports creative, so filtering by advertiser name overlooks reused accounts. Clustering by the shared click-through apex groups them together.
• One stable apex supporting many rotating subhosts provides the strongest cross-cluster pivot. Reputation coverage attached to the apex applies to every current and future label the operator creates beneath it.

MITRE Fight Fraud Framework (F3) Mapping

The mapping below aligns to the MITRE Center for Threat-Informed Defense Fight Fraud Framework (F3), https://ctid.mitre.org/fraud. F3 maps the first half of this campaign well: resource development, the social-ad initial contact, and brand impersonation. Because F3 focuses on financial fraud, it has no clean native technique for the curiosity-manipulation and ad-arbitrage-monetization stages. That gap is worth documenting instead of assigning an ill-fitting identifier.

Stage	Tactic	Technique	ID
Buy social and display ad placements to distribute the lure	Resource Development	Acquire Infrastructure: Malvertising	T1583.008
Buy and repurpose aged, dropped domains	Resource Development	Acquire Infrastructure: Domains	T1583.001
Stand up fake news-brand content sites	Resource Development	Create Fake Materials: Fake Website	F1020.002
Spin up disposable advertiser profiles	Resource Development	Establish Accounts	T1585
Re-skin dormant social accounts	Resource Development	Compromise Accounts: Social Media Accounts (approximate; fits only where accounts are taken over rather than operator-created)	T1586.001
Social-ad lure as initial contact	Initial Access	Phishing	T1660
News-brand subdomain squatting for trust	Initial Access	Impersonate Official (brand impersonation, approximate fit)	F1032
Convert traffic to ad and affiliate revenue	Monetization	No ad-arbitrage technique exists in F3 (framework gap)	FA0002

Indicators of Compromise

All indicators are defanged. This network contains no victim data; its landing pages are public clickbait.

Domains

Value	Role	Notes
besttopixs[.]com	Operator apex	Registered 2024 via Cosmotown, no WHOIS org; malicious in reputation data since 2025; the stable hub for the whole network

The successor apex topnewsource[.]com and the aged rotation apexes fiatagri[.]co and medianews48[.]com also carry malicious verdicts and are tracked separately. They are not included in this network's curated indicator list because their traffic belongs to the successor build described above.

Hosts

Value	Role	Notes
nbcnews[.]besttopixs[.]com	Brand-squat frontend	Impersonates NBC News
abcnews[.]besttopixs[.]com	Brand-squat frontend	Impersonates ABC News
gnews[.]besttopixs[.]com	Brand-squat frontend	Impersonates Google News
flysport[.]besttopixs[.]com	Content frontend	Highest-volume sports label
topdaily[.]besttopixs[.]com	Content frontend	High-volume news label
plant[.]besttopixs[.]com	Content frontend	Football clickbait label
sporting[.]besttopixs[.]com	Content frontend	Generic sports label
dailynews[.]besttopixs[.]com	Content frontend	Generic news label
nyheter[.]besttopixs[.]com	Content frontend	Swedish-language ("news"), non-English targeting
celebrity[.]besttopixs[.]com	Content frontend	Earlier-generation, inactive
viral[.]besttopixs[.]com	Content frontend	Earlier-generation, inactive
amazing[.]besttopixs[.]com	Content frontend	Earlier-generation, inactive
sport[.]besttopixs[.]com	Content frontend	Earlier-generation, inactive
sportnewss[.]besttopixs[.]com	Content frontend	Earlier-generation, inactive
smart1[.]besttopixs[.]com	Tracking backend	Redirect / ad-tracking, no content
smart2[.]besttopixs[.]com	Tracking backend	Redirect / ad-tracking, no content
smart3[.]besttopixs[.]com	Tracking backend	Redirect / ad-tracking, no content
smart5[.]besttopixs[.]com	Tracking backend	Redirect / ad-tracking, no content
ort[.]besttopixs[.]com	Tracking backend	Redirect / ad-tracking, no content

Facebook Advertiser Profiles

Value	Persona	Notes
facebook[.]com/profile.php?id=61583970457653	Lions Den Detroit	Highest-volume advertiser; feeds topdaily[.]; migrating to successor apex
facebook[.]com/profile.php?id=61588586765921	Honolulu Blue	Detroit persona; migrated onto successor apex
facebook[.]com/profile.php?id=61582914081279	Manchester City Global Fans	Feeds plant[.]; also seen on rotation apex
facebook[.]com/profile.php?id=61559153624651	Real Madrid Royal	LaLiga persona; feeds plant[.]
facebook[.]com/profile.php?id=61583114295306	YNWA Global Family	Liverpool persona; feeds plant[.]
facebook[.]com/profile.php?id=61582363276239	The Kop Games	Liverpool persona; feeds flysport[.]
facebook[.]com/profile.php?id=61587988615125	London Always Red	Arsenal persona; feeds flysport[.]
facebook[.]com/profile.php?id=61585226407346	Foxborough GameDay Syndicate	Patriots persona; feeds nbcnews[.] and abcnews[.]
facebook[.]com/profile.php?id=61580377889919	Kansas City Chiefdom	Chiefs persona; feeds gnews[.]
facebook[.]com/profile.php?id=61578736754454	The Patriots Beat	Patriots persona; feeds gnews[.]
facebook[.]com/profile.php?id=100091713945265	ABC Archaeology	Re-skinned dormant profile; feeds nbcnews[.]
facebook[.]com/profile.php?id=100090619381186	Beautiful House	Re-skinned home-decor profile; feeds flysport[.]
facebook[.]com/albin.zongor	Albin Zongor	Personal-name profile; feeds flysport[.]
facebook[.]com/amantedeloscachorros	Amante de los Cachorros	Spanish-language Cubs persona; feeds dailynews[.]
facebook[.]com/oddityoasis	Oddity Oasis	Re-skinned oddities profile; feeds abcnews[.]
...	representative subset	100+ verified-malicious Facebook advertiser profiles

Conclusion

The operator's design favors durability over speed. Subdomain rotation preserves the age of a single apex. Aged domains borrow trust that the operator never earned, while dormant accounts are recycled to avoid new-account heuristics. The move to a successor apex that squats fourteen outlets shows that the model is scaling rather than retreating. For defenders, the durable signals are structural and portable. The strongest is a real news brand used as a subdomain leaf label beneath an unrelated apex, combined with a /posts/<kebab-headline> path leading to ad-stuffed articles and a stable apex that quietly replenishes its subdomains long after individual ads are removed.